reconnaissance

Original：🇺🇸 English

Translated

Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.

2installs

Sourcetransilienceai/communitytools

Added on2026-04-14

NPX Install

npx skill4agent add transilienceai/communitytools reconnaissance

SKILL.md Content

View Translation Comparison →

Reconnaissance

Domain and web application reconnaissance. Discovers subdomains, open ports, endpoints, APIs, and JavaScript routes to build attack surface inventory.

Phases

Domain Assessment

Subdomain Discovery - Passive DNS, certificate transparency, DNS brute-forcing, zone transfers
Port Scanning - nmap/masscan (top 1000/10000/all), service detection, OS fingerprinting
Service Enumeration - Version detection, banner grabbing, protocol-specific enumeration

Web Application Mapping

Software Inventory - Dependencies, frameworks, SBOM generation
Active Scanning - ffuf, gobuster, nikto, ZAP spider for directories/files
API Discovery - REST, GraphQL, SOAP, WebSocket, Swagger/OpenAPI docs
JavaScript & SPA - Client-side routes, dynamic scripts, browser storage
Surface Analysis - Categorize attack surfaces, prioritize by risk

Output

inventory/  - JSON: subdomains, ports, endpoints, APIs, SBOM
analysis/   - MD: attack-surface, testing-checklist
raw/        - Tool outputs (nmap, ffuf, ZAP, subfinder)

Tools

subfinder, amass, nmap, masscan, ffuf, gobuster, nikto, ZAP, Playwright MCP

Related Skills

```
/osint
```
- Run alongside reconnaissance for repository enumeration, secret scanning, and git history analysis

Rules

Passive discovery before active scanning
Always run
```
/osint
```
in parallel during Phase 2
Respect rate limits
Verify subdomains are live before port scanning
Save all raw tool outputs